The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-89129: SAP_SE SAP NetWeaver AS Java (Web Services): Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated…5.8 MediumN/A0%Nov 10, 2026
CVE-2026-89128: SAP_SE SAP NetWeaver AS Java (Process Integration Test Tool): Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP…5.3 MediumN/A0%Nov 10, 2026
CVE-2026-89126: SAP_SE SAP Web Dispatcher: SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component10.0 CriticalN/A0%Nov 10, 2026
CVE-2026-89125: SAP_SE SAP Web Dispatcher and Internet Communication Manager: Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker…6.0 MediumN/A0%Nov 10, 2026
CVE-2026-89119: SAP_SE SAP Web Dispatcher and Internet Communication Manager: SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient…9.6 CriticalN/A0%Nov 10, 2026
CVE-2026-89115: SAP_SE SAP Start Service and SAP Microsoft Management Console: SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection4.4 MediumN/A0%Nov 10, 2026
CVE-2026-89114: SAP_SE SAP NetWeaver AS Java EDM Application: SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests7.5 HighN/A0%Nov 10, 2026
CVE-2026-89103: SAP_SE SAP Gateway: SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker…10.0 CriticalN/A0%Nov 10, 2026
CVE-2026-76973: SAP_SE SAP NetWeaver and ABAP Platform (SAP Message Server): Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an…7.5 HighN/A0%Nov 10, 2026
CVE-2026-76970: SAP_SE SAP NetWeaver and ABAP Platform: Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an…7.5 HighN/A0%Nov 10, 2026
CVE-2026-76966: SAP_SE SAP NetWeaver and ABAP Platform: Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP…8.9 HighN/A0%Nov 10, 2026
CVE-2026-76965: SAP_SE SAP NetWeaver and ABAP Platform: SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain…9.9 CriticalN/A0%Nov 10, 2026
CVE-2026-76964: SAP_SE SAP NetWeaver AS ABAP (Internet Communication Manager): SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal…10.0 CriticalN/A0%Nov 10, 2026
CVE-2026-125087: Michael-A-Kuykendall Shimmy: A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.47.3 High5.5 Medium0%Nov 10, 2026
CVE-2026-125086: D-Link M60: A vulnerability has been found in D-Link M60 1.12.B0110.0 Critical9.3 Critical1%Nov 10, 2026
CVE-2026-125082: sunkaifei FlyCMS: A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a3.5 Low2.0 Low0%Nov 10, 2026
CVE-2026-124604: GeoVision Inc. GV-Cloud: The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application…6.2 MediumN/A0%Nov 10, 2026
CVE-2026-124603: GeoVision Inc. GV-Cloud: An API key is hardcoded and retrievable from the GV-Cloud application package6.2 MediumN/A0%Nov 10, 2026
CVE-2026-124602: GeoVision Inc. GV-Access: The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access…6.2 MediumN/A0%Nov 10, 2026
CVE-2026-124601: GeoVision Inc. GV-Access: An API key is hardcoded and retrievable from the GV-Access package6.2 MediumN/A0%Nov 10, 2026
CVE-2026-124600: GeoVision Inc. GV-Face: GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connectionsN/A10.0 Critical0%Nov 10, 2026
CVE-2026-124599: GeoVision Inc. GV-Face: The RSA cryptographic key material, including a private key and public key, is embedded within the application package6.2 MediumN/A0%Nov 10, 2026
CVE-2026-124598: GeoVision Inc. GV-Face: An API key is hardcoded and retrievable from the GV-Face package7.5 HighN/A0%Nov 10, 2026
CVE-2026-123439: Rejected reason: This CVE ID has been rejected as a duplicate.N/AN/AN/ANov 10, 2026
CVE-2026-123438: Rejected reason: This CVE ID has been rejected as a duplicate.N/AN/AN/ANov 10, 2026
351-375 of 507850